@sberpay-cli/cli-diagnostic 0.4.0-dev.5 → 0.4.0-dev.8

package/package/dist/binding-worker.mjs

@@ -27038,6 +27038,76 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 
+// packages/cli/src/core/windowsAcl.ts
+import { spawnSync } from "node:child_process";
+import { dirname, win32 } from "node:path";
+var Sid = external_exports.string().regex(/^S-1-(?:\d+-)*\d+$/);
+var Inspection = external_exports.object({ owner: Sid, currentUser: Sid, reparse: external_exports.literal(false), rules: external_exports.array(external_exports.object({ sid: Sid, allow: external_exports.boolean(), rights: external_exports.number().int() })).min(1) });
+var WRITE_ACCESS = 852310 | 1342177280;
+function assertWindowsAcl(value, policy) {
+  const parsed = Inspection.safeParse(value);
+  if (!parsed.success) throw Error("WINDOWS_ACL_UNSAFE");
+  const s = parsed.data, trusted = /* @__PURE__ */ new Set([s.currentUser, "S-1-5-18", "S-1-5-32-544"]);
+  if (!trusted.has(s.owner) || s.rules.some((r) => r.allow && !trusted.has(r.sid) && (policy === "private" ? r.rights !== 0 : (r.rights & WRITE_ACCESS) !== 0))) throw Error("WINDOWS_ACL_UNSAFE");
+}
+var SCRIPT = String.raw`
+$ErrorActionPreference='Stop'
+[Console]::OutputEncoding=New-Object System.Text.UTF8Encoding($false)
+$p=[IO.Path]::GetFullPath($env:SBERPAY_ACL_PATH)
+$cursor=$p
+while($cursor){
+ if(Test-Path -LiteralPath $cursor){
+  $item=Get-Item -LiteralPath $cursor -Force
+  if(($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0){throw 'REPARSE_POINT'}
+ }
+ $next=[IO.Path]::GetDirectoryName($cursor)
+ if($next -eq $cursor){break};$cursor=$next
+}
+$sid=[Security.Principal.WindowsIdentity]::GetCurrent().User
+if($env:SBERPAY_ACL_ACTION -eq 'create' -and !(Test-Path -LiteralPath $p)){
+ $acl=New-Object Security.AccessControl.DirectorySecurity
+ $acl.SetOwner($sid);$acl.SetAccessRuleProtection($true,$false)
+ foreach($id in @($sid.Value,'S-1-5-18','S-1-5-32-544')){
+  $principal=New-Object Security.Principal.SecurityIdentifier($id)
+  $rule=New-Object Security.AccessControl.FileSystemAccessRule($principal,'FullControl','ContainerInherit,ObjectInherit','None','Allow')
+  $acl.AddAccessRule($rule)
+ }
+ [IO.Directory]::CreateDirectory($p,$acl)|Out-Null
+}
+$acl=Get-Acl -LiteralPath $p
+$rules=@($acl.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])|ForEach-Object{
+ @{sid=$_.IdentityReference.Value;allow=($_.AccessControlType -eq 'Allow');rights=[int]$_.FileSystemRights}
+})
+@{owner=$acl.GetOwner([Security.Principal.SecurityIdentifier]).Value;currentUser=$sid.Value;reparse=$false;rules=$rules}|ConvertTo-Json -Compress -Depth 5
+`;
+function windowsAclCommand(path, action, env = process.env) {
+  const root = env.SystemRoot;
+  if (!root || !win32.isAbsolute(root)) throw Error("WINDOWS_SYSTEM_ROOT_MISSING");
+  return { file: win32.join(root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe"), args: ["-NoLogo", "-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(SCRIPT, "utf16le").toString("base64")], env: { SystemRoot: root, SBERPAY_ACL_PATH: path, SBERPAY_ACL_ACTION: action } };
+}
+function inspect(path, policy, action) {
+  const c = windowsAclCommand(path, action);
+  const r = spawnSync(c.file, c.args, { env: c.env, encoding: "utf8", windowsHide: true, timeout: 1e4, maxBuffer: 128 * 1024 });
+  if (r.error || r.status !== 0) throw Error("WINDOWS_ACL_CHECK_FAILED");
+  let value;
+  try {
+    value = JSON.parse(r.stdout.trim().replace(/^\uFEFF/, ""));
+  } catch {
+    throw Error("WINDOWS_ACL_CHECK_FAILED");
+  }
+  assertWindowsAcl(value, policy);
+}
+function assertWindowsPrivatePath(path) {
+  inspect(path, "private", "inspect");
+}
+function ensureWindowsPrivateDirectory(path) {
+  inspect(path, "private", "create");
+}
+function assertWindowsHelperPath(path) {
+  inspect(path, "binary", "inspect");
+  inspect(dirname(path), "binary", "inspect");
+}
+
 // packages/cli/src/core/paths.ts
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -27278,7 +27348,7 @@ var active;
 var journalEvent = (kind2, data) => active?.event(kind2, data);
 
 // packages/cli/src/core/context.ts
-import { appendFileSync, mkdirSync as mkdirSync5 } from "node:fs";
+import { appendFileSync, mkdirSync as mkdirSync5, existsSync as existsSync7 } from "node:fs";
 import { join as join6 } from "node:path";
 
 // packages/netlog/src/masking.ts
@@ -27454,15 +27524,18 @@ async function loggedFetch(logger, meta3, url2, init = {}) {
 }
 
 // packages/cli/src/core/config.ts
-import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
 import { join as join3 } from "node:path";
 
 // packages/cli/src/core/atomicFile.ts
-import { mkdirSync, openSync, writeFileSync, fsyncSync, closeSync, renameSync, rmSync } from "node:fs";
-import { dirname } from "node:path";
+import { mkdirSync, existsSync, openSync, writeFileSync, fsyncSync, closeSync, renameSync, rmSync } from "node:fs";
+import { dirname as dirname2 } from "node:path";
 import { randomUUID as randomUUID2 } from "node:crypto";
 function atomicJson(path, value) {
-  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  if (process.platform === "win32") {
+    ensureWindowsPrivateDirectory(dirname2(path));
+    if (existsSync(path)) assertWindowsPrivatePath(path);
+  } else mkdirSync(dirname2(path), { recursive: true, mode: 448 });
   const temp = `${path}.${randomUUID2()}.tmp`;
   try {
     const fd = openSync(temp, "wx", 384);
@@ -27474,7 +27547,7 @@ function atomicJson(path, value) {
     }
     renameSync(temp, path);
     if (process.platform !== "win32") {
-      const dir = openSync(dirname(path), "r");
+      const dir = openSync(dirname2(path), "r");
       try {
         fsyncSync(dir);
       } finally {
@@ -27487,8 +27560,8 @@ function atomicJson(path, value) {
 }
 
 // packages/cli/src/core/fileLock.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, rmSync as rmSync2, renameSync as renameSync2, existsSync } from "node:fs";
-import { dirname as dirname2, join as join2 } from "node:path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, rmSync as rmSync2, renameSync as renameSync2, existsSync as existsSync2 } from "node:fs";
+import { dirname as dirname3, join as join2 } from "node:path";
 import { randomUUID as randomUUID3 } from "node:crypto";
 
 // packages/cli/src/core/output.ts
@@ -27610,7 +27683,7 @@ function owner(path) {
   }
 }
 async function withFileLock(path, fn, timeoutMs = 5e3) {
-  mkdirSync2(dirname2(path), { recursive: true, mode: 448 });
+  mkdirSync2(dirname3(path), { recursive: true, mode: 448 });
   const nonce2 = randomUUID3(), deadline = Date.now() + timeoutMs;
   for (; ; ) {
     try {
@@ -27637,7 +27710,7 @@ async function withFileLock(path, fn, timeoutMs = 5e3) {
         } finally {
           if (acquired) rmSync2(reaper, { recursive: true, force: true });
         }
-        if (!existsSync(path)) continue;
+        if (!existsSync2(path)) continue;
       }
       if (Date.now() >= deadline)
         throw new CliError(EXIT.CONFIG_OR_NETWORK, "BINDING_BUSY", "\u0414\u0440\u0443\u0433\u0430\u044F \u043A\u043E\u043C\u0430\u043D\u0434\u0430 \u0432\u043B\u0430\u0434\u0435\u0435\u0442 \u0441\u043E\u0441\u0442\u043E\u044F\u043D\u0438\u0435\u043C \u0438\u043B\u0438 \u0432\u043B\u0430\u0434\u0435\u043B\u0435\u0446 \u0431\u043B\u043E\u043A\u0438\u0440\u043E\u0432\u043A\u0438 \u043D\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u0435\u043D. \u041F\u043E\u0432\u0442\u043E\u0440\u0438\u0442\u0435 \u043F\u043E\u0437\u0436\u0435.");
@@ -27656,7 +27729,7 @@ import { fileURLToPath } from "node:url";
 var NPM_PACKAGE = true ? "@sberpay-cli/cli-diagnostic" : "@sberpay-cli/cli";
 var kind = true ? "release" : "dev";
 var BUILD = {
-  sourceCommit: true ? "225bb38f8d48221f803cde8fcccc21a170308643" : "dev",
+  sourceCommit: true ? "7f4bbd2ecf2ceb9eec2d043b2487863d9a74e578" : "dev",
   profile: true ? "diagnostic" : "standard",
   kind,
   // Бандл — dist/cli.mjs в корне пакета; этот файл под tsx — packages/cli/src/core/.
@@ -27719,8 +27792,9 @@ function isStand(value) {
 }
 function loadConfig(paths, build = BUILD) {
   const file2 = join3(paths.configDir, "config.json");
-  if (!existsSync2(file2)) return defaultConfig(build);
+  if (!existsSync3(file2)) return defaultConfig(build);
   try {
+    if (process.platform === "win32") assertWindowsPrivatePath(file2);
     return { ...defaultConfig(build), ...JSON.parse(readFileSync3(file2, "utf8")) };
   } catch (error62) {
     throw new CliError(
@@ -27847,7 +27921,7 @@ async function updateConfig(paths, transform3) {
 // packages/cli/src/core/secrets.ts
 import {
   chmodSync as chmodSync2,
-  existsSync as existsSync5,
+  existsSync as existsSync6,
   mkdirSync as mkdirSync4,
   readFileSync as readFileSync5,
   renameSync as renameSync3,
@@ -28402,7 +28476,7 @@ function softwareDeviceKeys(storage, where = "os") {
 }
 
 // packages/device/src/helper.ts
-import { spawn, spawnSync } from "node:child_process";
+import { spawn, spawnSync as spawnSync2 } from "node:child_process";
 var HELPER_PROTOCOL = 1;
 var TIMEOUT_MS = 15e3;
 var MAX_OUTPUT_BYTES = 64 * 1024;
@@ -28470,7 +28544,7 @@ async function callHelper(path, request, schema) {
   return parseReply(request.op, code, stdout, schema);
 }
 function callHelperSync(path, request, schema) {
-  const result = spawnSync(path, [], {
+  const result = spawnSync2(path, [], {
     input: encode3(request),
     env: helperEnv(),
     stdio: ["pipe", "pipe", "ignore"],
@@ -28500,8 +28574,8 @@ function helperSecrets(helper) {
 
 // packages/device/src/hardware.ts
 import { createPublicKey as createPublicKey2, verify } from "node:crypto";
-import { chmodSync, closeSync as closeSync2, existsSync as existsSync3, fsyncSync as fsyncSync2, linkSync, mkdirSync as mkdirSync3, openSync as openSync2, readFileSync as readFileSync4, rmSync as rmSync3, writeSync } from "node:fs";
-import { dirname as dirname3 } from "node:path";
+import { chmodSync, closeSync as closeSync2, existsSync as existsSync4, fsyncSync as fsyncSync2, linkSync, mkdirSync as mkdirSync3, openSync as openSync2, readFileSync as readFileSync4, rmSync as rmSync3, writeSync } from "node:fs";
+import { dirname as dirname4 } from "node:path";
 var B64URL2 = external_exports.string().max(4096).regex(/^[A-Za-z0-9_-]+$/);
 var Point = external_exports.object({ x: B64URL2, y: B64URL2 });
 var Blobs = external_exports.object({ signKey: B64URL2, encKey: B64URL2 });
@@ -28517,7 +28591,7 @@ function toPublicKeys(pub) {
   return { deviceId: jwkThumbprint(publicKey), publicKey, encKey: jwk(pub.encPublicKey, "enc") };
 }
 function readBlobs(file2, kind2) {
-  if (!existsSync3(file2)) return void 0;
+  if (!existsSync4(file2)) return void 0;
   const parsed = KeyFile.safeParse((() => {
     try {
       return JSON.parse(readFileSync4(file2, "utf8"));
@@ -28529,7 +28603,7 @@ function readBlobs(file2, kind2) {
   return { signKey: parsed.data.signKey, encKey: parsed.data.encKey };
 }
 function saveNewBlobs(file2, kind2, blobs) {
-  mkdirSync3(dirname3(file2), { recursive: true, mode: 448 });
+  mkdirSync3(dirname4(file2), { recursive: true, mode: 448 });
   const tmp = `${file2}.${process.pid}.${Date.now()}.tmp`;
   const fd = openSync2(tmp, "wx", 384);
   try {
@@ -28562,7 +28636,7 @@ function checkSignature(pub, data, signature) {
   return signature;
 }
 async function hardwareAvailable(helper) {
-  if (!existsSync3(helper)) return false;
+  if (!existsSync4(helper)) return false;
   try {
     return (await callHelper(helper, { op: "status" }, external_exports.object({ available: external_exports.boolean() }))).available;
   } catch {
@@ -28592,7 +28666,7 @@ function hardwareDeviceKeys({ kind: kind2, helper, file: file2 }) {
   return {
     kind: kind2,
     storage: "hardware",
-    exists: () => Boolean(blobs) || existsSync3(file2),
+    exists: () => Boolean(blobs) || existsSync4(file2),
     ensure: publicKeys,
     async sign(data) {
       const signKey = required2().signKey;
@@ -28626,9 +28700,9 @@ function hardwareDeviceKeys({ kind: kind2, helper, file: file2 }) {
 }
 
 // packages/cli/src/core/keyHelper.ts
-import { existsSync as existsSync4, realpathSync, statSync } from "node:fs";
-import { dirname as dirname4, isAbsolute, join as join4 } from "node:path";
-var PACKAGED = { "darwin-arm64": "darwin", "darwin-x64": "darwin", "linux-x64": "linux-x64", "linux-arm64": "linux-arm64" };
+import { existsSync as existsSync5, realpathSync, statSync } from "node:fs";
+import { dirname as dirname5, isAbsolute, join as join4 } from "node:path";
+var PACKAGED = { "darwin-arm64": "darwin", "darwin-x64": "darwin", "linux-x64": "linux-x64", "linux-arm64": "linux-arm64", "win32-x64": "win32-x64", "win32-arm64": "win32-arm64" };
 function chipOf(platform2) {
   if (platform2 === "darwin") return "secure-enclave";
   return platform2 === "linux" || platform2 === "win32" ? "tpm" : void 0;
@@ -28653,9 +28727,17 @@ function keyHelperFixHint(build = BUILD) {
 var WRITABLE_BY_GROUP = 16;
 var WRITABLE_BY_OTHERS = 2;
 function isTrustedFile(path) {
+  if (process.platform === "win32") {
+    try {
+      assertWindowsHelperPath(path);
+      return true;
+    } catch {
+      return false;
+    }
+  }
   const real = realpathSync(path);
   const uid = process.getuid?.() ?? 0;
-  return [real, dirname4(real)].every((p) => {
+  return [real, dirname5(real)].every((p) => {
     const st = statSync(p);
     const groupOk = (st.mode & WRITABLE_BY_GROUP) === 0;
     return (st.uid === uid || st.uid === 0) && (st.mode & WRITABLE_BY_OTHERS) === 0 && groupOk;
@@ -28667,9 +28749,9 @@ function unavailable(message2, hint) {
 function findKeyHelper(opts) {
   const path = opts.override ?? opts.installed;
   if (!isAbsolute(path)) throw unavailable(`\u041F\u0443\u0442\u044C \u043A \u0445\u0435\u043B\u043F\u0435\u0440\u0443 ${path} \u0434\u043E\u043B\u0436\u0435\u043D \u0431\u044B\u0442\u044C \u0430\u0431\u0441\u043E\u043B\u044E\u0442\u043D\u044B\u043C`, "\u0423\u043A\u0430\u0436\u0438\u0442\u0435 \u043F\u043E\u043B\u043D\u044B\u0439 \u043F\u0443\u0442\u044C \u0432 SBERPAY_KEY_HELPER");
-  if (!existsSync4(path)) return void 0;
+  if (!existsSync5(path)) return void 0;
   if (!isTrustedFile(path)) {
-    throw unavailable(`\u0425\u0435\u043B\u043F\u0435\u0440 ${path} \u043D\u0435 \u043F\u0440\u0438\u043D\u0430\u0434\u043B\u0435\u0436\u0438\u0442 \u043F\u043E\u043B\u044C\u0437\u043E\u0432\u0430\u0442\u0435\u043B\u044E \u0438\u043B\u0438 \u0434\u043E\u0441\u0442\u0443\u043F\u0435\u043D \u043D\u0430 \u0437\u0430\u043F\u0438\u0441\u044C \u0434\u0440\u0443\u0433\u0438\u043C`, "\u041F\u0435\u0440\u0435\u0443\u0441\u0442\u0430\u043D\u043E\u0432\u0438\u0442\u0435 sberpay-cli; \u043F\u0440\u0430\u0432\u0430 \u043D\u0430 \u0445\u0435\u043B\u043F\u0435\u0440 \u0438 \u0435\u0433\u043E \u043A\u0430\u0442\u0430\u043B\u043E\u0433 \u2014 0755, \u0432\u043B\u0430\u0434\u0435\u043B\u0435\u0446 \u2014 \u0432\u044B \u0438\u043B\u0438 root");
+    throw unavailable(`\u0425\u0435\u043B\u043F\u0435\u0440 ${path} \u043D\u0435 \u043F\u0440\u0438\u043D\u0430\u0434\u043B\u0435\u0436\u0438\u0442 \u043F\u043E\u043B\u044C\u0437\u043E\u0432\u0430\u0442\u0435\u043B\u044E \u0438\u043B\u0438 \u0434\u043E\u0441\u0442\u0443\u043F\u0435\u043D \u043D\u0430 \u0437\u0430\u043F\u0438\u0441\u044C \u0434\u0440\u0443\u0433\u0438\u043C`, "\u041F\u0435\u0440\u0435\u0443\u0441\u0442\u0430\u043D\u043E\u0432\u0438\u0442\u0435 sberpay-cli; \u043F\u0440\u0430\u0432\u0430 \u043D\u0430 \u0445\u0435\u043B\u043F\u0435\u0440 \u0438 \u0435\u0433\u043E \u043A\u0430\u0442\u0430\u043B\u043E\u0433: Unix 0755; Windows \u2014 \u0437\u0430\u043F\u0438\u0441\u044C \u0442\u043E\u043B\u044C\u043A\u043E \u0432\u043B\u0430\u0434\u0435\u043B\u044C\u0446\u0443, SYSTEM \u0438 Administrators");
   }
   return path;
 }
@@ -28735,9 +28817,14 @@ function osSecretStore(standName, stand, opts = {}) {
 }
 function fileSecretStore(paths, stand) {
   const file2 = join5(paths.configDir, `secrets.${stand}.json`);
-  const read = () => existsSync5(file2) ? JSON.parse(readFileSync5(file2, "utf8")) : {};
+  const read = () => {
+    if (!existsSync6(file2)) return {};
+    if (process.platform === "win32") assertWindowsPrivatePath(file2);
+    return JSON.parse(readFileSync5(file2, "utf8"));
+  };
   const write = (data) => {
-    mkdirSync4(paths.configDir, { recursive: true, mode: 448 });
+    if (process.platform === "win32") ensureWindowsPrivateDirectory(paths.configDir);
+    else mkdirSync4(paths.configDir, { recursive: true, mode: 448 });
     if (Object.keys(data).length === 0) return rmSync4(file2, { force: true });
     const tmp = `${file2}.${process.pid}.tmp`;
     writeFileSync3(tmp, JSON.stringify(data), { mode: 384 });
@@ -28764,8 +28851,12 @@ function openSecretStore(paths, standName, stand, opts = {}) {
 // packages/cli/src/core/context.ts
 var DEFAULT_LOGGING = join6(BUILD.root, "config", "logging.yaml");
 function fileSink(paths, verbose) {
-  mkdirSync5(paths.stateDir, { recursive: true, mode: 448 });
+  if (process.platform === "win32") ensureWindowsPrivateDirectory(paths.stateDir);
+  else mkdirSync5(paths.stateDir, { recursive: true, mode: 448 });
   const logFile = join6(paths.stateDir, "cli.log");
+  if (process.platform === "win32") {
+    if (existsSync7(logFile)) assertWindowsPrivatePath(logFile);
+  }
   return (line) => {
     appendFileSync(logFile, `${line}
 `, { mode: 384 });
@@ -28784,6 +28875,7 @@ var netLogger = (sink) => {
 function buildCoreContext(opts, overridePaths) {
   const out = createOutput(Boolean(opts.json));
   const paths = overridePaths ?? cliPaths();
+  if (process.platform === "win32") for (const path of Object.values(paths)) ensureWindowsPrivateDirectory(path);
   const config2 = loadConfig(paths);
   const requested = opts.stand ?? config2.stand;
   if (!isStand(requested)) throw new CliError(EXIT.VALIDATION, "INVALID_ARGUMENT", `\u041D\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043D\u044B\u0439 \u0441\u0442\u0435\u043D\u0434 \xAB${requested}\xBB: ${STAND_NAMES.join(", ")}`);
@@ -28812,7 +28904,7 @@ function buildCoreContext(opts, overridePaths) {
 }
 
 // packages/cli/src/schemes/v2/deviceKeys.ts
-import { existsSync as existsSync6 } from "node:fs";
+import { existsSync as existsSync8 } from "node:fs";
 import { join as join7 } from "node:path";
 var DEVICE_SECRETS = ["deviceSignKey", "deviceEncKey"];
 var SOFTWARE_ORDER = ["hardware", "os", "file"];
@@ -28850,6 +28942,7 @@ async function selectDeviceKeys(core, sel = {}) {
   const backend = keyHelperBackend(platform2);
   const hint = backend ? keyHelperBuildHint(backend) : `\u041D\u0430 ${platform2} \u0430\u043F\u043F\u0430\u0440\u0430\u0442\u043D\u044B\u0445 \u043A\u043B\u044E\u0447\u0435\u0439 \u043D\u0435\u0442`;
   const hardwareFile = backend && hardwareKeyFile(core, backend.kind);
+  if (process.platform === "win32" && hardwareFile && existsSync8(hardwareFile)) assertWindowsPrivatePath(hardwareFile);
   let helperLookup;
   const keyHelper = () => {
     helperLookup ??= { path: backend && findKeyHelper({ override: overrides.SBERPAY_KEY_HELPER, installed: sel.installedHelper ?? backend.path }) };
@@ -28868,7 +28961,7 @@ async function selectDeviceKeys(core, sel = {}) {
     const cached2 = probes.get(storage);
     if (cached2) return cached2;
     const result = (() => {
-      if (storage === "hardware") return { ok: true, hasKeys: Boolean(hardwareFile && existsSync6(hardwareFile)) };
+      if (storage === "hardware") return { ok: true, hasKeys: Boolean(hardwareFile && existsSync8(hardwareFile)) };
       try {
         return { ok: true, hasKeys: stores[storage]().get(SIGN_KEY_NAME) !== void 0 };
       } catch {
@@ -29234,7 +29327,7 @@ function ensureTrustFor(url2, store = tls, roots = PINNED_ROOTS, now = /* @__PUR
 }
 
 // packages/cli/src/core/version.ts
-var CLI_VERSION = "0.4.0-dev.5";
+var CLI_VERSION = "0.4.0-dev.8";
 
 // packages/cli/src/core/http.ts
 var USER_AGENT = `sberpay-cli/${CLI_VERSION}`;